Engineering leads evaluated the CVSS score and prioritized the fi before working it into an upcoming sprint schedule. Then, finally, they shipped the update. That deliberate cadence is a thing of the past.
In the first nine months of 2026, publishers recorded 75,242 CVEs, representing roughly 20% of all vulnerabilities published since the CVE program was established in 1999. The acceleration is steepening: according to the Cyber Strategy Institute, nearly 38,000 of those flaws surfaced in Q3 alone. "The pace of vulnerability discovery has outpaced the human capacity to remediate it.
Engineering organizations face a stark operational reality: the traditional two-week patch cycle is dead." The pace of vulnerability discovery has outpaced the human capacity to remediate it. Engineering organizations face a stark operational reality: the traditional two-week patch cycle is dead.
